Hackers Targeting 217 Android Finance Apps, Draining PINs, Patterns and Passwords: Zimperium

A new Android banking trojan is targeting 217 banking and cryptocurrency apps while giving attackers broad control over infected devices.

The malware is called Rokarolla and is distributed through malicious websites that disguise it as popular applications such as TikTok and Google Chrome, reports the mobile cybersecurity firm Zimperium.

Zimperium says Rokarolla is designed to compromise financial and crypto applications by using fake screens that appear on top of legitimate apps.

The malware can steal device unlock credentials, including PINs, patterns and passwords, by displaying a fake Android lock screen. Zimperium says information entered into the fake screen is then sent to attacker-controlled infrastructure.

The report says Rokarolla can also steal banking and cryptocurrency credentials when victims open targeted financial apps. Once the malware identifies a targeted app, it can display a fake login page to capture credentials or credit card information.

Zimperium says the malware contains 137 commands that allow attackers to control infected devices, collect SMS messages, steal contact lists, record user input and monitor what appears on the screen.

Rokarolla can also block incoming calls, mute device audio and disable Google Play Protect, according to the report.

The cybersecurity firm says the malware can intercept SMS messages, send texts on behalf of victims and prevent users from receiving fraud alerts from banks.

Zimperium says Rokarolla targets more than 200 financial, cryptocurrency and social media applications, including 217 distinct cryptocurrency and banking apps.

The firm says the malware’s features are designed to facilitate financial fraud and prevent victims from interrupting malicious activity on infected devices.

Newsletter]

Generated Image: Midjourney